aws-dynamodb: TableV2 with DynamoEventSource triggers deprecated TableGrantsProps#policyResource and #encryptedResource warnings during synth

[pepdek-transdev]

Describe the bug

Using TableV2 with dynamo_stream=StreamViewType.NEW_IMAGE and attaching a DynamoEventSource to a Lambda produces deprecation warnings during cdk synth. The warnings originate inside CDK's own grantStreamRead() call — not from user code. There is no way to avoid them from user-land.

doing cdk synth leads to warnings:

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

No deprecation warnings when using only supported, non-deprecated APIs.

Current Behavior

Warnings appear once per TableV2 instance that has a DynamoEventSource attached.

Reproduction Steps

table = dynamodb.TableV2(
    self, "MyTable",
    partition_key=dynamodb.Attribute(name="pk", type=dynamodb.AttributeType.STRING),
    dynamo_stream=dynamodb.StreamViewType.NEW_IMAGE,
    billing=dynamodb.Billing.on_demand(),
)

fn.add_event_source(
    lvs.DynamoEventSource(
        table=table,
        starting_position=lbd.StartingPosition.LATEST,
    )
)



### Possible Solution

Root cause (suspected by claude :-))
DynamoEventSource.bind() internally calls table.grantStreamRead(), which constructs TableGrantsProps with the deprecated policyResource and encryptedResource fields. This is CDK-internal usage; user code cannot influence it.

### Additional Information/Context

#### WARNING OUTPUT:

[WARNING] aws-cdk-lib.aws_dynamodb.TableGrantsProps#policyResource is deprecated.
  - Leave this field undefined. A best-effort attempt will be made to discover a resource policy and add permissions to it.
  This API will be removed in the next major release.
[WARNING] aws-cdk-lib.aws_dynamodb.TableGrantsProps#encryptedResource is deprecated.
  - Leave this field undefined. If the table is encrypted with a customer-managed KMS key, appropriate grants to the key will be automatically added.
  This API will be removed in the next major release.

### AWS CDK Library version (aws-cdk-lib)

2.242.0

### AWS CDK CLI version

2.1110.0 (build 970da46)

### Node.js Version

2.242.0

### OS

Linux TRANSDEV 5.15.167.4-microsoft-standard-WSL2 #1 SMP Tue Nov 5 00:21:55 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

### Language

Python

### Language Version

3.13.9

### Other information

_No response_

[pahud]

Hi @pepdek-transdev,

Issue at a Glance:

┌─────────────────────┐     ┌──────────────────────────┐     ┌─────────────────────────────┐
│  DynamoEventSource   │     │  table.grantStreamRead() │     │  TableV2 constructor         │
│  .bind()             │──>  │  (table-v2-base.ts)      │──>  │  new TableGrants({           │
│                      │     │                          │     │    encryptedResource: ...,   │
│                      │     │                          │     │    policyResource: this,     │
└─────────────────────┘     └──────────────────────────┘     │  })                          │
                                                              └──────────────┬──────────────┘
                                                                             │
                                                                             v
                                                              ┌─────────────────────────────┐
                                                              │  JSII emits @deprecated      │
                                                              │  warnings for both fields    │
                                                              └─────────────────────────────┘

Thank you for reporting this. I was able to reproduce the issue with aws-cdk-lib@2.243.0 — a minimal TableV2 + DynamoEventSource setup triggers both deprecation warnings during cdk synth, with no user-land workaround.

Root Cause:

It appears the TableV2 constructor explicitly passes the deprecated encryptedResource and policyResource fields when constructing TableGrants. However, the TableGrants constructor already has auto-discovery fallback logic that correctly resolves these from the table construct when the fields are omitted. This means the explicit passing is unnecessary and is the sole cause of the warnings.

In my opinion, the fix is to simply remove the deprecated field assignments from the three new TableGrants() call sites in table-v2.ts and let the auto-discovery handle it. I haven't tried it, but I reviewed the auto-discovery code path and it should not cause a breaking change — EncryptedResources.of() and ResourceWithPolicies.of() resolve to the same construct via duck-typing, and grantOnKey() is a no-op when there's no customer-managed KMS key (optional chaining on this.encryptionKey).

Reproduction summary: Confirmed with a minimal TypeScript CDK app — TableV2 with StreamViewType.NEW_IMAGE + DynamoEventSource produces both [WARNING] messages on cdk synth. Synth succeeds but warnings cannot be suppressed.

If anyone from the community would like to contribute a fix, this would be a great first PR — the change is well-scoped to table-v2.ts and involves removing the deprecated field assignments from three locations.

[ccxbt]

Hi! I'd like to work on this. I'll prepare a small fix to suppress these deprecation warnings in / and open a PR.

[ccxbt]

Small correction: I'll update grantReadWriteData and grantReadData to avoid the deprecation warnings, then open a PR.